Card security questionable as checkout extends to laptops, tablets
The library – a university service as old as academia itself – has long afforded students the ability to check out materials to be returned in a timely fashion. At least that’s traditionally been the idea.
Over time, however, the resources students need to complete their coursework have evolved, and in many cases their value has skyrocketed.
At Philadelphia’s Drexel University and other campus libraries across the country, students can check out expensive equipment such as laptops and tablets. With such valuable materials available, questions arise with the security of the patron ID process in the modern library.
To check out these coveted devices, are students required to do anything more than swipe a card or hold it under the red glow of a bar code scanner?
A 2002 CR80News article on library patron ID explored how mag stripes seemed to be replacing bar codes as the gold standard for library identification. After nearly 15 years and the arrival of newer and more secure card technologies, it seems logical that things would once again have progressed. But are new technologies being used to drive credentials into library systems today?
“Although a large portion of libraries continue to use the bar code to retrieve patron data for book check out, we are seeing an increase in alternate technologies,” says Fred Emery, Heartland OneCard director of sales.
Contactless is making inroads at the library, says Kent Pawlak, Blackboard Transact’s director of product strategy. “There are still many libraries that request bar code on a card, but that is decreasing as they accept contactless and other identity verification methods,” he adds.
Still, bar codes are the tool of choice at the vast majority of libraries, says Grey Bartholomew, product manager for Odyssey PCS and Odyssey Direct at CBORD. “Anecdotally I would say 95-98% of our campuses are using bar code, 2-5% mag stripe and virtually none are using prox or contactless.”
Heartland’s Emery concurs, citing that about 85% of the company’s clients still use bar code, 10% use mag stripe and about 5% use some form of contactless technology.
Bartholomew believes that it less about universities opting for bar code than simply going with what they know. “I would say that bar code has been the standard for so long that campuses – library management specifically – takes the path of least resistance and sticks with what they know,” he explains. “However, campus card professionals see the benefits of card technology standardization and are beginning to educate library managers on other options.”
The example of checking out laptops and tablets is crucial to this education because it stresses the value of the materials that students have access to using their campus card.
While a vast majority will utilize a service like this properly and return the gear, the worst-case scenario could paint a very different picture. Suppose a student decided to produce counterfeit cards with valid identification numbers and use them to check out and resell expensive equipment.
The long-standing king of library check out remains the bar code. But it is an inherently insecure technology designed to expedite data entry and reduce human data input errors. Common bar codes are based on standardized symbologies so there is nothing secret or obscure about library codes, nor are they difficult to reproduce. Much like type fonts, most bar code formats are available for download online.
“Bar codes are primarily used to identify check-out materials, and as a result, every circulation station already has a bar code scanner,” says Pawlak. “The use of bar codes on cards at libraries has primarily been due to the simple fact that the reader was readily available.”
Over time, however, more libraries discovered that they could identify the patron in a different manner than the one they use identify books and materials. This realization, according to Pawlak, ushered in the acceptance of other card technologies.
“One driving factor is security. Bar codes are readily duplicable, providing for higher risk of fraud,” explains Pawlak. Additionally, the need for a bar code is often outweighed by the valuable card real estate it requires and the few demands for it beyond the library.
As for those valuable checkout materials, it seems that universities may be taking notice of the vulnerabilities of the bar code. “Quite often we see use of patron ID solutions other than the bar code – mag stripe or contactless – for check out of non-book items, such as laptops and AV equipment, particularly if the items are being managed in a system outside of the one used to check out books,” says Emery.